@draftlab/auth 0.15.0 → 0.16.0

package/dist/{error.d.mts → types/error.d.ts}

@@ -1,4 +1,3 @@
-//#region src/error.d.ts
 /**
  * Error classes and types for Draft Auth operations.
  * Provides comprehensive error handling for OAuth 2.0 and authentication flows.
@@ -38,93 +37,93 @@
  * Standard OAuth error types
  * These error codes are returned by OAuth authorization servers.
  */
-type OauthErrorType = "invalid_request" | "invalid_client" | "invalid_grant" | "invalid_token" | "invalid_redirect_uri" | "insufficient_scope" | "unauthorized_client" | "access_denied" | "unsupported_grant_type" | "server_error" | "temporarily_unavailable" | "unsupported_response_type";
+export type OauthErrorType = "invalid_request" | "invalid_client" | "invalid_grant" | "invalid_token" | "invalid_redirect_uri" | "insufficient_scope" | "unauthorized_client" | "access_denied" | "unsupported_grant_type" | "server_error" | "temporarily_unavailable" | "unsupported_response_type";
 /**
  * Base OAuth error class for handling standard OAuth error responses.
  * Contains both the error code and human-readable description.
  */
-declare class OauthError extends Error {
-  /** The OAuth error code as defined in the specification */
-  readonly error: OauthErrorType;
-  /** Human-readable description of the error */
-  readonly description: string;
-  /**
-   * Creates a new OAuth error with the specified error code and description.
-   *
-   * @param error - The OAuth error type
-   * @param description - Human-readable error description
-   *
-   * @example
-   * ```ts
-   * throw new OauthError("invalid_grant", "Authorization code has expired")
-   * ```
-   */
-  constructor(error: OauthErrorType, description: string);
-  /**
-   * Converts the error to a standard OAuth JSON response format.
-   *
-   * @returns Object with error and error_description fields
-   *
-   * @example
-   * ```ts
-   * const oauthError = new OauthError("invalid_request", "Missing parameter")
-   * return c.json(oauthError.toJSON(), 400)
-   * ```
-   */
-  toJSON(): {
-    error: OauthErrorType;
-    error_description: string;
-  };
+export declare class OauthError extends Error {
+    /** The OAuth error code as defined in the specification */
+    readonly error: OauthErrorType;
+    /** Human-readable description of the error */
+    readonly description: string;
+    /**
+     * Creates a new OAuth error with the specified error code and description.
+     *
+     * @param error - The OAuth error type
+     * @param description - Human-readable error description
+     *
+     * @example
+     * ```ts
+     * throw new OauthError("invalid_grant", "Authorization code has expired")
+     * ```
+     */
+    constructor(error: OauthErrorType, description: string);
+    /**
+     * Converts the error to a standard OAuth JSON response format.
+     *
+     * @returns Object with error and error_description fields
+     *
+     * @example
+     * ```ts
+     * const oauthError = new OauthError("invalid_request", "Missing parameter")
+     * return c.json(oauthError.toJSON(), 400)
+     * ```
+     */
+    toJSON(): {
+        error: OauthErrorType;
+        error_description: string;
+    };
 }
 /**
  * Error thrown when a provider parameter is missing from the authorization request.
  * Occurs when multiple providers are configured but no specific provider is selected.
  */
-declare class MissingProviderError extends OauthError {
-  /**
-   * Creates a missing provider error.
-   * Thrown when the provider query parameter is required but not provided.
-   */
-  constructor();
+export declare class MissingProviderError extends OauthError {
+    /**
+     * Creates a missing provider error.
+     * Thrown when the provider query parameter is required but not provided.
+     */
+    constructor();
 }
 /**
  * Error thrown when a required parameter is missing from a request.
  * Used for validating OAuth request parameters.
  */
-declare class MissingParameterError extends OauthError {
-  /** The name of the missing parameter */
-  readonly parameter: string;
-  /**
-   * Creates a missing parameter error.
-   *
-   * @param parameter - The name of the missing parameter
-   *
-   * @example
-   * ```ts
-   * throw new MissingParameterError("client_id")
-   * ```
-   */
-  constructor(parameter: string);
+export declare class MissingParameterError extends OauthError {
+    /** The name of the missing parameter */
+    readonly parameter: string;
+    /**
+     * Creates a missing parameter error.
+     *
+     * @param parameter - The name of the missing parameter
+     *
+     * @example
+     * ```ts
+     * throw new MissingParameterError("client_id")
+     * ```
+     */
+    constructor(parameter: string);
 }
 /**
  * Error thrown when a client is not authorized to use a specific redirect URI.
  * Prevents unauthorized clients from hijacking authorization codes.
  */
-declare class UnauthorizedClientError extends OauthError {
-  /** The client ID that attempted unauthorized access */
-  readonly clientID: string;
-  /**
-   * Creates an unauthorized client error.
-   *
-   * @param clientID - The client ID attempting unauthorized access
-   * @param redirectURI - The unauthorized redirect URI
-   *
-   * @example
-   * ```ts
-   * throw new UnauthorizedClientError("malicious-client", "https://evil.com/callback")
-   * ```
-   */
-  constructor(clientID: string, redirectURI: string);
+export declare class UnauthorizedClientError extends OauthError {
+    /** The client ID that attempted unauthorized access */
+    readonly clientID: string;
+    /**
+     * Creates an unauthorized client error.
+     *
+     * @param clientID - The client ID attempting unauthorized access
+     * @param redirectURI - The unauthorized redirect URI
+     *
+     * @example
+     * ```ts
+     * throw new UnauthorizedClientError("malicious-client", "https://evil.com/callback")
+     * ```
+     */
+    constructor(clientID: string, redirectURI: string);
 }
 /**
  * Error thrown when the authentication flow is in an unknown or invalid state.
@@ -144,12 +143,12 @@ declare class UnauthorizedClientError extends OauthError {
  * }
  * ```
  */
-declare class UnknownStateError extends Error {
-  /**
-   * Creates an unknown state error.
-   * Indicates that the authentication flow cannot continue due to missing state.
-   */
-  constructor();
+export declare class UnknownStateError extends Error {
+    /**
+     * Creates an unknown state error.
+     * Indicates that the authentication flow cannot continue due to missing state.
+     */
+    constructor();
 }
 /**
  * Error thrown when a subject (user identifier) is invalid or malformed.
@@ -164,11 +163,11 @@ declare class UnknownStateError extends Error {
  * }
  * ```
  */
-declare class InvalidSubjectError extends Error {
-  /**
-   * Creates an invalid subject error.
-   */
-  constructor();
+export declare class InvalidSubjectError extends Error {
+    /**
+     * Creates an invalid subject error.
+     */
+    constructor();
 }
 /**
  * Error thrown when a refresh token is invalid, expired, or revoked.
@@ -187,11 +186,11 @@ declare class InvalidSubjectError extends Error {
  * }
  * ```
  */
-declare class InvalidRefreshTokenError extends Error {
-  /**
-   * Creates an invalid refresh token error.
-   */
-  constructor();
+export declare class InvalidRefreshTokenError extends Error {
+    /**
+     * Creates an invalid refresh token error.
+     */
+    constructor();
 }
 /**
  * Error thrown when an access token is invalid, expired, or malformed.
@@ -210,11 +209,11 @@ declare class InvalidRefreshTokenError extends Error {
  * }
  * ```
  */
-declare class InvalidAccessTokenError extends Error {
-  /**
-   * Creates an invalid access token error.
-   */
-  constructor();
+export declare class InvalidAccessTokenError extends Error {
+    /**
+     * Creates an invalid access token error.
+     */
+    constructor();
 }
 /**
  * Error thrown when an authorization code is invalid, expired, or already used.
@@ -233,11 +232,10 @@ declare class InvalidAccessTokenError extends Error {
  * }
  * ```
  */
-declare class InvalidAuthorizationCodeError extends Error {
-  /**
-   * Creates an invalid authorization code error.
-   */
-  constructor();
+export declare class InvalidAuthorizationCodeError extends Error {
+    /**
+     * Creates an invalid authorization code error.
+     */
+    constructor();
 }
-//#endregion
-export { InvalidAccessTokenError, InvalidAuthorizationCodeError, InvalidRefreshTokenError, InvalidSubjectError, MissingParameterError, MissingProviderError, OauthError, OauthErrorType, UnauthorizedClientError, UnknownStateError };
+//# sourceMappingURL=error.d.ts.map

package/dist/types/error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"error.d.ts","sourceRoot":"","sources":["../../src/error.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH;;;GAGG;AACH,MAAM,MAAM,cAAc,GACvB,iBAAiB,GACjB,gBAAgB,GAChB,eAAe,GACf,eAAe,GACf,sBAAsB,GACtB,oBAAoB,GACpB,qBAAqB,GACrB,eAAe,GACf,wBAAwB,GACxB,cAAc,GACd,yBAAyB,GACzB,2BAA2B,CAAA;AAE9B;;;GAGG;AACH,qBAAa,UAAW,SAAQ,KAAK;IACpC,2DAA2D;IAC3D,SAAgB,KAAK,EAAE,cAAc,CAAA;IACrC,8CAA8C;IAC9C,SAAgB,WAAW,EAAE,MAAM,CAAA;IAEnC;;;;;;;;;;OAUG;gBACS,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM;IAOtD;;;;;;;;;;OAUG;IACH,MAAM;;;;CAMN;AAED;;;GAGG;AACH,qBAAa,oBAAqB,SAAQ,UAAU;IACnD;;;OAGG;;CAQH;AAED;;;GAGG;AACH,qBAAa,qBAAsB,SAAQ,UAAU;IACpD,wCAAwC;IACxC,SAAgB,SAAS,EAAE,MAAM,CAAA;IAEjC;;;;;;;;;OASG;gBACS,SAAS,EAAE,MAAM;CAK7B;AAED;;;GAGG;AACH,qBAAa,uBAAwB,SAAQ,UAAU;IACtD,uDAAuD;IACvD,SAAgB,QAAQ,EAAE,MAAM,CAAA;IAEhC;;;;;;;;;;OAUG;gBACS,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM;CAQjD;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,iBAAkB,SAAQ,KAAK;IAC3C;;;OAGG;;CAOH;AAED;;;;;;;;;;;;GAYG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;IAC7C;;OAEG;;CAKH;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,wBAAyB,SAAQ,KAAK;IAClD;;OAEG;;CAKH;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,uBAAwB,SAAQ,KAAK;IACjD;;OAEG;;CAKH;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,6BAA8B,SAAQ,KAAK;IACvD;;OAEG;;CAKH"}

package/dist/types/index.d.ts

@@ -0,0 +1,2 @@
+export { issuer } from "./core";
+//# sourceMappingURL=index.d.ts.map

package/dist/types/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA"}

package/dist/{keys.d.mts → types/keys.d.ts}

@@ -1,27 +1,24 @@
-import { StorageAdapter } from "./storage/storage.mjs";
-import { CryptoKey, JWK } from "jose";
-
-//#region src/keys.d.ts
-
+import { type CryptoKey, type JWK } from "jose";
+import { type StorageAdapter } from "./storage/storage";
 /**
  * Runtime key pair with loaded cryptographic keys and metadata.
  * Ready for immediate use in signing and encryption operations.
  */
-interface KeyPair {
-  /** Unique identifier for the key pair */
-  readonly id: string;
-  /** Algorithm used for this key pair */
-  readonly alg: string;
-  /** Loaded public key for verification/encryption */
-  readonly public: CryptoKey;
-  /** Loaded private key for signing/decryption */
-  readonly private: CryptoKey;
-  /** Date when the key was created */
-  readonly created: Date;
-  /** Optional expiration date */
-  readonly expired?: Date;
-  /** JSON Web Key representation for JWKS endpoints */
-  readonly jwk: JWK;
+export interface KeyPair {
+    /** Unique identifier for the key pair */
+    readonly id: string;
+    /** Algorithm used for this key pair */
+    readonly alg: string;
+    /** Loaded public key for verification/encryption */
+    readonly public: CryptoKey;
+    /** Loaded private key for signing/decryption */
+    readonly private: CryptoKey;
+    /** Date when the key was created */
+    readonly created: Date;
+    /** Optional expiration date */
+    readonly expired?: Date;
+    /** JSON Web Key representation for JWKS endpoints */
+    readonly jwk: JWK;
 }
 /**
  * Loads or generates signing keys for JWT operations.
@@ -42,7 +39,7 @@ interface KeyPair {
  *   .sign(currentKey.private)
  * ```
  */
-declare const signingKeys: (storage: StorageAdapter) => Promise<KeyPair[]>;
+export declare const signingKeys: (storage: StorageAdapter) => Promise<KeyPair[]>;
 /**
  * Loads or generates encryption keys for token encryption operations.
  * Returns existing valid keys, or generates new ones if none are available.
@@ -62,6 +59,5 @@ declare const signingKeys: (storage: StorageAdapter) => Promise<KeyPair[]>;
  *   .encrypt(currentKey.public)
  * ```
  */
-declare const encryptionKeys: (storage: StorageAdapter) => Promise<KeyPair[]>;
-//#endregion
-export { KeyPair, encryptionKeys, signingKeys };
+export declare const encryptionKeys: (storage: StorageAdapter) => Promise<KeyPair[]>;
+//# sourceMappingURL=keys.d.ts.map

package/dist/types/keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../../src/keys.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,KAAK,SAAS,EAOd,KAAK,GAAG,EACR,MAAM,MAAM,CAAA;AAGb,OAAO,EAAW,KAAK,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAoChE;;;GAGG;AACH,MAAM,WAAW,OAAO;IACvB,yCAAyC;IACzC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,uCAAuC;IACvC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,oDAAoD;IACpD,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAA;IAC1B,gDAAgD;IAChD,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAA;IAC3B,oCAAoC;IACpC,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAA;IACtB,+BAA+B;IAC/B,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,CAAA;IACvB,qDAAqD;IACrD,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAA;CACjB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,WAAW,GAAU,SAAS,cAAc,KAAG,OAAO,CAAC,OAAO,EAAE,CAmE5E,CAAA;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,cAAc,GAAU,SAAS,cAAc,KAAG,OAAO,CAAC,OAAO,EAAE,CAiE/E,CAAA"}

package/dist/types/mutex.d.ts

@@ -0,0 +1,42 @@
+/**
+ * A Mutex (mutual exclusion lock) for async functions.
+ * It allows only one async task to access a critical section at a time.
+ *
+ * @example
+ * const mutex = new Mutex();
+ *
+ * async function criticalSection() {
+ *   await mutex.acquire();
+ *   try {
+ *     // This code section cannot be executed simultaneously
+ *   } finally {
+ *     mutex.release();
+ *   }
+ * }
+ */
+export declare class Mutex {
+    private semaphore;
+    /**
+     * Checks if the mutex is currently locked.
+     * @returns True if the mutex is locked, false otherwise.
+     */
+    get isLocked(): boolean;
+    /**
+     * Acquires the mutex, blocking if necessary until it is available.
+     * @returns A promise that resolves when the mutex is acquired.
+     */
+    acquire(): Promise<void>;
+    /**
+     * Releases the mutex, allowing another waiting task to proceed.
+     */
+    release(): void;
+    /**
+     * Runs a function while holding the mutex lock.
+     * Automatically acquires before and releases after the function execution.
+     *
+     * @param fn - The function to execute while holding the lock
+     * @returns The result of the function
+     */
+    runExclusive<T>(fn: () => Promise<T>): Promise<T>;
+}
+//# sourceMappingURL=mutex.d.ts.map

package/dist/types/mutex.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mutex.d.ts","sourceRoot":"","sources":["../../src/mutex.ts"],"names":[],"mappings":"AA8DA;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,KAAK;IACjB,OAAO,CAAC,SAAS,CAAmB;IAEpC;;;OAGG;IACH,IAAI,QAAQ,IAAI,OAAO,CAEtB;IAED;;;OAGG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAI9B;;OAEG;IACH,OAAO,IAAI,IAAI;IAIf;;;;;;OAMG;IACG,YAAY,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;CAQvD"}

package/dist/{pkce.d.mts → types/pkce.d.ts}

@@ -1,4 +1,3 @@
-//#region src/pkce.d.ts
 /**
  * PKCE (Proof Key for Code Exchange) implementation for OAuth security.
  * Provides protection against authorization code interception attacks by using
@@ -12,12 +11,12 @@ type PKCEMethod = "S256" | "plain";
  * Complete PKCE challenge data containing verifier, challenge, and method.
  */
 interface PKCEChallenge {
-  /** The code verifier to be sent to the token endpoint */
-  readonly verifier: string;
-  /** The code challenge to be sent to the authorization endpoint */
-  readonly challenge: string;
-  /** The challenge method used */
-  readonly method: "S256";
+    /** The code verifier to be sent to the token endpoint */
+    readonly verifier: string;
+    /** The code challenge to be sent to the authorization endpoint */
+    readonly challenge: string;
+    /** The challenge method used */
+    readonly method: "S256";
 }
 /**
  * Generates a complete PKCE challenge for OAuth authorization requests.
@@ -41,7 +40,7 @@ interface PKCEChallenge {
  *
  * @throws {RangeError} If length is outside valid range or generated verifier doesn't meet requirements
  */
-declare const generatePKCE: (length?: number) => Promise<PKCEChallenge>;
+export declare const generatePKCE: (length?: number) => Promise<PKCEChallenge>;
 /**
  * Validates a PKCE code verifier against a previously generated challenge.
  * Uses timing-safe comparison and timing normalization to prevent timing attacks.
@@ -67,6 +66,6 @@ declare const generatePKCE: (length?: number) => Promise<PKCEChallenge>;
  * }
  * ```
  */
-declare const validatePKCE: (verifier: string, challenge: string, method?: PKCEMethod) => Promise<boolean>;
-//#endregion
-export { generatePKCE, validatePKCE };
+export declare const validatePKCE: (verifier: string, challenge: string, method?: PKCEMethod) => Promise<boolean>;
+export {};
+//# sourceMappingURL=pkce.d.ts.map

package/dist/types/pkce.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkce.d.ts","sourceRoot":"","sources":["../../src/pkce.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AAEH;;GAEG;AACH,KAAK,UAAU,GAAG,MAAM,GAAG,OAAO,CAAA;AA0DlC;;GAEG;AACH,UAAU,aAAa;IACtB,yDAAyD;IACzD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,kEAAkE;IAClE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,gCAAgC;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACvB;AAmCD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,YAAY,GAAU,eAAW,KAAG,OAAO,CAAC,aAAa,CA0BrE,CAAA;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,YAAY,GACxB,UAAU,MAAM,EAChB,WAAW,MAAM,EACjB,SAAQ,UAAmB,KACzB,OAAO,CAAC,OAAO,CAqDjB,CAAA"}

package/dist/types/provider/apple.d.ts

@@ -0,0 +1,197 @@
+/**
+ * Apple authentication provider for Draft Auth.
+ * Implements OAuth 2.0 flow for authenticating users with their Apple accounts.
+ *
+ * ## Quick Setup
+ *
+ * ```ts
+ * import { AppleProvider } from "@draftlab/auth/provider/apple"
+ *
+ * export default issuer({
+ *   basePath: "/auth", // Important for callback URL
+ *   providers: {
+ *     apple: AppleProvider({
+ *       clientID: process.env.APPLE_CLIENT_ID,
+ *       clientSecret: process.env.APPLE_CLIENT_SECRET,
+ *       scopes: ["name", "email"]
+ *     })
+ *   }
+ * })
+ * ```
+ *
+ * **Callback URL Pattern**: `{baseURL}{basePath}/{provider}/callback`
+ * - Development: `http://localhost:3000/auth/apple/callback`
+ * - Production: `https://yourapp.com/auth/apple/callback`
+ *
+ * Register this URL in your Apple Developer Portal.
+ *
+ * ## Setup Instructions
+ *
+ * ### 1. Create App ID
+ * - Go to [Apple Developer](https://developer.apple.com)
+ * - Create a new App ID with "Sign in with Apple" capability
+ *
+ * ### 2. Create Service ID
+ * - Create a new Service ID (this is your clientID)
+ * - Configure "Sign in with Apple"
+ * - Add your redirect URI
+ *
+ * ### 3. Create Private Key
+ * - Create a private key for "Sign in with Apple"
+ * - Download the .p8 file (this is used to create your clientSecret)
+ *
+ * ## Client Secret Generation
+ *
+ * Apple requires a JWT token as the client secret. You'll need:
+ * - Key ID from the private key
+ * - Team ID from your Apple Developer account
+ * - Private key (.p8 file)
+ *
+ * Use a library to generate the JWT (valid for ~15 minutes):
+ *
+ * ```ts
+ * import { SignJWT } from "jose"
+ *
+ * const secret = await new SignJWT({
+ *   iss: "YOUR_TEAM_ID",
+ *   aud: "https://appleid.apple.com",
+ *   sub: process.env.APPLE_CLIENT_ID,
+ *   iat: Math.floor(Date.now() / 1000),
+ *   exp: Math.floor(Date.now() / 1000) + 15 * 60
+ * })
+ *   .setProtectedHeader({ alg: "ES256", kid: "YOUR_KEY_ID" })
+ *   .sign(privateKey)
+ * ```
+ *
+ * ## Common Scopes
+ *
+ * - `name` - Access user's name (first and last name)
+ * - `email` - Access user's email address
+ *
+ * Note: Apple only returns user data on the first authorization. Subsequent authorizations won't include name/email.
+ *
+ * ## User Data Access
+ *
+ * ```ts
+ * success: async (ctx, value) => {
+ *   if (value.provider === "apple") {
+ *     const accessToken = value.tokenset.access
+ *
+ *     // Apple doesn't provide a userinfo endpoint
+ *     // User data is returned in the authorization response
+ *     // You need to parse the id_token JWT to get user info
+ *
+ *     // For subsequent logins without name/email, use the subject (user_id)
+ *     // from the ID token to identify the user
+ *   }
+ * }
+ * ```
+ *
+ * @packageDocumentation
+ */
+import { type Oauth2WrappedConfig } from "./oauth2";
+/**
+ * Configuration options for Apple OAuth 2.0 provider.
+ * Extends the base OAuth 2.0 configuration with Apple-specific documentation.
+ */
+export interface AppleConfig extends Oauth2WrappedConfig {
+    /**
+     * Apple Service ID (app identifier for your Sign in with Apple implementation).
+     * Get this from your Apple Developer account when creating a Service ID.
+     *
+     * @example
+     * ```ts
+     * {
+     *   clientID: "com.example.app.signin"
+     * }
+     * ```
+     */
+    readonly clientID: string;
+    /**
+     * Apple client secret (JWT token signed with your private key).
+     * This is different from other providers - Apple requires a JWT token
+     * generated from your private key.
+     *
+     * @example
+     * ```ts
+     * {
+     *   clientSecret: process.env.APPLE_CLIENT_SECRET
+     * }
+     * ```
+     */
+    readonly clientSecret: string;
+    /**
+     * Apple OAuth scopes to request access for.
+     * Apple only supports "name" and "email" scopes.
+     *
+     * Important: Apple only provides user data (name, email) on the FIRST authorization.
+     * Subsequent authorizations won't include this data.
+     *
+     * @example
+     * ```ts
+     * {
+     *   scopes: ["name", "email"]
+     * }
+     * ```
+     */
+    readonly scopes: string[];
+}
+/**
+ * Creates an Apple OAuth 2.0 authentication provider.
+ * Allows users to authenticate using their Apple accounts.
+ *
+ * @param config - Apple OAuth 2.0 configuration
+ * @returns OAuth 2.0 provider configured for Apple
+ *
+ * @example
+ * ```ts
+ * // Basic Apple authentication
+ * const basicApple = AppleProvider({
+ *   clientID: process.env.APPLE_CLIENT_ID,
+ *   clientSecret: process.env.APPLE_CLIENT_SECRET
+ * })
+ *
+ * // Apple with name and email scopes
+ * const appleWithScopes = AppleProvider({
+ *   clientID: process.env.APPLE_CLIENT_ID,
+ *   clientSecret: process.env.APPLE_CLIENT_SECRET,
+ *   scopes: ["name", "email"]
+ * })
+ *
+ * // Using the tokens and id_token
+ * export default issuer({
+ *   providers: { apple: appleWithScopes },
+ *   success: async (ctx, value) => {
+ *     if (value.provider === "apple") {
+ *       // Apple returns user data in the initial authorization response
+ *       // You need to decode the id_token to extract user information
+ *
+ *       // The id_token contains:
+ *       // - sub: unique Apple user identifier
+ *       // - email: user email (only on first authorization)
+ *       // - email_verified: whether email is verified
+ *       // - is_private_email: whether user used private relay
+ *
+ *       // Decode and verify the id_token using jose:
+ *       // const verified = await jwtVerify(value.tokenset.id, jwks)
+ *       // const user = verified.payload
+ *
+ *       return ctx.subject("user", {
+ *         appleId: user.sub,
+ *         email: user.email,
+ *         emailVerified: user.email_verified,
+ *         isPrivateEmail: user.is_private_email
+ *       })
+ *     }
+ *   }
+ * })
+ * ```
+ *
+ * **Callback URL Pattern**: `{baseURL}{basePath}/{provider}/callback`
+ * - Development: `http://localhost:3000/auth/apple/callback`
+ * - Production: `https://yourapp.com/auth/apple/callback`
+ *
+ * Register this URL in your Apple Developer Portal.
+ */
+export declare const AppleProvider: (config: AppleConfig) => import("./provider").Provider<import("./oauth2").Oauth2UserData>;
+//# sourceMappingURL=apple.d.ts.map

package/dist/types/provider/apple.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"apple.d.ts","sourceRoot":"","sources":["../../../src/provider/apple.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0FG;AAEH,OAAO,EAAkB,KAAK,mBAAmB,EAAE,MAAM,UAAU,CAAA;AAEnE;;;GAGG;AACH,MAAM,WAAW,WAAY,SAAQ,mBAAmB;IACvD;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IAEzB;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAE7B;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CACzB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AACH,eAAO,MAAM,aAAa,GAAI,QAAQ,WAAW,qEAShD,CAAA"}